I need to bring my Luxembourg organisation into compliance with recital 74 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 74 clarifies how Article 28 DORA on exit strategies should be operationalised. The CSSF sanctions two recurring failures in practice: ICT contracts without an operational transition clause (the provider terminates at D+30 and the financial entity has no fallback), and the absence of resolution resilient clauses required under BRRD Directive 2014/59/EU. During a bank resolution, a cloud provider that terminates or suspends service on grounds of restructuring can derail the entire procedure. The recital therefore requires Luxembourg banks, investment firms and other financial entities to harden their critical ICT contracts on three axes: minimum notice periods, mandatory transition periods, and non-termination / non-suspension / non-modification clauses in resolution scenarios.The 5 exit clauses the CSSF expects in your critical ICT contractsAsymmetric minimum notice: at least 90 days from the provider, shorter from the financial entity, with documented triggers (SLA breach, international sanctions, change of control).Mandatory transition period: 6 to 18 months during which the provider continues delivering the service at contractual conditions, enabling switch to another provider or in-house solution.Resolution resilient clause: no termination, suspension or modification on grounds of restructuring or BRRD resolution, as long as the financial entity meets its payment obligations.Technical reversibility: contractual commitment to deliver data in an exploitable format, architecture documentation, and migration assistance (with SLA and penalties).Tested exit plan: contractual obligation to participate in annual switchover tests, with reporting to the management body and available to the CSSF.How Luxgap automates this riskOur Luxgap Exit Strategy Vault turns the exit strategy from a dormant PDF in a Legal folder into an executable, continuously tested switchover plan. A specialised LLM agent reads each critical ICT contract (imported from DocuSign, Ironclad, SharePoint or your DMS) and detects within 60 seconds the missing exit clauses against Recital 74 and Article 28 DORA, cross-referenced with the criticality classification from your ICT third-party register.Automatically detects the absence of non-termination, non-suspension, non-modification clauses in contracts with cloud providers, core banking vendors, payment processors and data centres (eBRC, LuxConnect, Microsoft, AWS, Temenos, Avaloq).Generates for each critical contract a pre-filled exit plan with a transition period calibrated to service complexity (IaaS, critical SaaS, core banking) and realistic reversibility timeline.Computes a resolution resilience score per contract, opposable to the CSSF and resolution authorities, mapped to BRRD expectations and DORA RTS on contractual arrangements.Orchestrates annual switchover tests via runbooks integrated with Azure DevOps, ServiceNow or Jira, with timestamped signed execution evidence.Alerts in real time via Teams or...

Recital 74 DORA — Recital 74 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 74

Digital Operational Resilience Act · UE 2022/2554

(74)

Such contractual arrangements should also provide for dedicated exit strategies to enable, in particular, mandatory transition periods during which ICT third-party service providers should continue providing the relevant services with a view to reducing the risk of disruptions at the level of the financial entity, or to allow the latter effectively to switch to the use of other ICT third-party service providers or, alternatively, to change to in-house solutions, consistent with the complexity of the provided ICT service. Moreover, financial entities within the scope of Directive 2014/59/EU should ensure that the relevant contracts for ICT services are robust and fully enforceable in the event of resolution of those financial entities. Therefore, in line with the expectations of the resolution authorities, those financial entities should ensure that the relevant contracts for ICT services are resolution resilient. As long as they continue meeting their payment obligations, those financial entities should ensure, among other requirements, that the relevant contracts for ICT services contain clauses for non-termination, non-suspension and non-modification on grounds of restructuring or resolution.

Luxembourg specificity

loi luxembourgeoise du 18 décembre 2015 relative à la défaillance des établissements de crédit et de certaines entreprises d'investissement, et circulaire CSSF 22/806 sur l'externalisation TIC

In Luxembourg, the Banque centrale du Luxembourg acts as national resolution authority alongside the Single Resolution Board (SRB) for significant institutions. The Law of 18 December 2015 on the resolution of credit institutions and certain investment firms transposes BRRD and requires critical ICT contracts to be resolution resilient, in direct alignment with DORA Recital 74. The CSSF verifies this articulation during its ICT governance inspections.

Luxgap practice: we systematically map your contractual clauses against combined CSSF (Circular 22/806 on ICT outsourcing) and BCL resolution expectations, to prevent a non-EU cloud provider from invoking its home jurisdiction to escape non-termination clauses.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 74 clarifies how Article 28 DORA on exit strategies should be operationalised. The CSSF sanctions two recurring failures in practice: ICT contracts without an operational transition clause (the provider terminates at D+30 and the financial entity has no fallback), and the absence of resolution resilient clauses required under BRRD Directive 2014/59/EU. During a bank resolution, a cloud provider that terminates or suspends service on grounds of restructuring can derail the entire procedure. The recital therefore requires Luxembourg banks, investment firms and other financial entities to harden their critical ICT contracts on three axes: minimum notice periods, mandatory transition periods, and non-termination / non-suspension / non-modification clauses in resolution scenarios.

The 5 exit clauses the CSSF expects in your critical ICT contracts

Asymmetric minimum notice: at least 90 days from the provider, shorter from the financial entity, with documented triggers (SLA breach, international sanctions, change of control).
Mandatory transition period: 6 to 18 months during which the provider continues delivering the service at contractual conditions, enabling switch to another provider or in-house solution.
Resolution resilient clause: no termination, suspension or modification on grounds of restructuring or BRRD resolution, as long as the financial entity meets its payment obligations.
Technical reversibility: contractual commitment to deliver data in an exploitable format, architecture documentation, and migration assistance (with SLA and penalties).
Tested exit plan: contractual obligation to participate in annual switchover tests, with reporting to the management body and available to the CSSF.

How Luxgap automates this risk

Our Luxgap Exit Strategy Vault turns the exit strategy from a dormant PDF in a Legal folder into an executable, continuously tested switchover plan. A specialised LLM agent reads each critical ICT contract (imported from DocuSign, Ironclad, SharePoint or your DMS) and detects within 60 seconds the missing exit clauses against Recital 74 and Article 28 DORA, cross-referenced with the criticality classification from your ICT third-party register.

Automatically detects the absence of non-termination, non-suspension, non-modification clauses in contracts with cloud providers, core banking vendors, payment processors and data centres (eBRC, LuxConnect, Microsoft, AWS, Temenos, Avaloq).
Generates for each critical contract a pre-filled exit plan with a transition period calibrated to service complexity (IaaS, critical SaaS, core banking) and realistic reversibility timeline.
Computes a resolution resilience score per contract, opposable to the CSSF and resolution authorities, mapped to BRRD expectations and DORA RTS on contractual arrangements.
Orchestrates annual switchover tests via runbooks integrated with Azure DevOps, ServiceNow or Jira, with timestamped signed execution evidence.
Alerts in real time via Teams or Slack when a provider announces restructuring, acquisition or financial deterioration (cross-referencing Dun & Bradstreet, specialised press, registries).
Produces a cryptographically sealed PDF report, opposable during a CSSF inspection or in dialogue with the Banque centrale du Luxembourg as resolution authority.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real critical ICT contracts, with a free 48h white audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 74

They trust us

Before we chat